Enhanced Password-Based Authentication Mechanism in Cloud Computing with Extended Honey Encryption (XHE): A Case Study on Diabetes Dataset

Abstract

The recent advancement on cloud technologies promises a cost-effective, scalable and easier maintenance data solution for individuals, government agencies and corporations. However, existing cloud security solutions that exclusively depend on conventional password-based authentication mechanism cannot productively defence to ongoing password guessing and cracking attacks. Recent HashCat attack would brute be able to compel any hashed eight-characters-length secret key that comprises of any blend of 95 characters in less than 2.5 h. Several trivial approaches such as two-factor authentication, grid-based authentication and biometric authentication mechanisms have been enforced recently as an additional or optional countermeasure of defending password guessing and cracking attacks. These approaches, be that as it may, can be frustrated with an ongoing malware assault that capable of intercepting One-Time Password (OTP) sent to the mobile device. These stolen passwords often do not trigger any alerts and can be subsequently exploited to access other users’ cloud accounts (e.g. 61% of the users are utilizing the single secret key repeatedly to access different online records). To address these problems, this research aimed to implement an eXtended Honey Encryption (XHE) scheme for improving the assurance of conventional password-based authentication mechanism in cloud computing. At the point when the attacker tries to retrieve the patient’s diabetes information by speculating password, rather than dismissing their record access as a customary security defence mechanisms, the proposed XHE outputs an indistinct counterfeit patient’s record that closely resembles the legitimate patients’ diabetes information in light of each off base speculation on legitimate password. Along these lines, the implemented XHE scheme solidifies the multifaceted nature of password speculating and cracking assaults, as assailant cannot distinguish which of his speculated passwords is correct password. Then, a security message will be produced and delivered to alert the network administrator and security responses team. Furthermore, the potential implementation of the proposed XHE scheme can be aimed at improving the password-based authentication system in other networks, including but not limited to Internet of Things (IoT) and mobile computing.